id240941[.]com

This domain, id240941.com, poses a credential theft threat by impersonating YouTube’s copyright strike notification system. Attackers use this tactic to trick content creators or channel owners into entering their account credentials under false pretenses, potentially leading to account hijacking, unauthorized video deletions, or further exploitation of linked services. The site mimics legitimate YouTube alerts, leveraging urgency around copyright violations to bypass user skepticism and capture login details via fake forms. Analysis indicates the domain was registered on January 6, 2026, through Hello Internet Corp, an uncommon registrar for this type of activity. It resolves to the IP address 188.114.97.3, hosted on Cloudflare’s network (AS13335), which is frequently abused for phishing infrastructure due to its low-cost and high-availability services. At the time of detection, 21 out of 95 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The absence of an SSL certificate further suggests minimal effort to legitimize the site, a common trait in short-lived phishing campaigns. If you visited id240941.com or entered credentials on a page resembling YouTube’s copyright strike notice, take immediate action. First, change the password for your YouTube account and any other platforms where the same credentials were reused. Enable multi-factor authentication (MFA) if not already active. Review your account for unauthorized activity, such as unfamiliar videos, comments, or channel settings changes. If you provided additional sensitive information, monitor linked accounts (e.g., Google, payment services) for suspicious transactions. Report the incident to YouTube’s security team and consider running a malware scan on the device used to access the site, as some phishing pages may deploy secondary payloads.